By Jan Thornborough
While most of us were on holiday or just cowering from the rain over the long weekend, cybercriminals were busy launching ‘carding attacks’ against fundraising websites.
A carding attack is where criminals have a database of stolen credit card numbers and automated tools that systematically try one-dollar donations on fundraising websites to find active cards. The criminals scan social media advertising to find suitable victims. Once they find an unsuspecting fundraising website, the criminal’s automated tools will keep systematically testing each card number until successful. When a donation succeeds, they know they’ve got a valid credit card number. So, it’s happy days for them as they empty the card up to the credit limit elsewhere.
Attacks like these are widespread and not isolated to just fundraising sites. Any unprotected e-commerce website is fair game.
If you are the owner of a fundraising or e-commerce site that has noticed a lot of unsuccessful small transactions interspersed with the occasional successful one, you should check it out.
Here are some steps to take:
- Get your IT provider to take down your website until they have an appropriate solution to limit the chances of this happening again. Note I said limit, not eradicate because the attackers continually change their tactics.
- Make sure your IT provider has a suitably informative notice to put up in the place of your website, perhaps offering the option of a phone donation while the site is unavailable.
- Notify your bank (hopefully, they will be the one notifying you as they keep an eye out for this kind of activity).
- Banks can offer great advice on the best way to reimburse the stolen funds.
- Talk to your payment processing vendor and see if they are willing to waiver any processing fees for the fraudulent activity.
- If you didn’t have one at the start of this list, create a simple incident management plan that you and your staff can refer to the next time you are subject to a cyber-attack. The faster you can act, the less damage you will need to fix.
If you want expert advice and guidance on how to make your organisation more cyber resilient contact Jan Thornborough at Intelligensia, your local New Zealand owned and operated Cyber resilience firm intelligensia.co.nz
